The truth about audits.

Audits don't prevent fraud - they verify financial statements. Here's what to know about the limitations of audits and internal controls.

Imagine the scene: The chief financial officer has been found to have misappropriated funds from the association. The board sets up a meeting with the auditor.

The first question posed to the auditor is, "Why didn't you catch this during your audit?" The auditor responds, by rote: "Our responsibility under generally accepted auditing standards promulgated by the American Institute of Certified Public Accountants is to express an opinion on the organization's financial statements."

A board member asks, "What does that mean and what about the fraud?" The impassive auditor responds, again by rote: "We designed our audit to provide reasonable assurance of detecting errors and irregularities that are material to the financial statements."

The annoyed board member presses the auditor: "What does material mean?" The auditor responds with what appears to be another nonanswer: "That's largely a matter of professional judgment."

The board dismisses the auditor and the discussion continues as a board member asks, "Do we need better auditors or better internal controls?" Another comments, "Maybe we need better oversight of management."

Revelations about fiscal misconduct in nonprofit organizations have drawn increasing attention to the auditor's role in the detection of fraud. Despite ongoing efforts by the American Institute of Certified Public Accountants (AICPA), New York City, to clarify the auditor's responsibilities, the widespread yet unfounded expectation remains that a financial statement audit ensures adherence to an implied standard of financial rectitude - that it is an enforcement tool designed to uncover all irregularities.

Heightened public anxiety and expanding government oversight emphasize the ever-increasing importance of fiscal accountability and this critical question: Who is minding the store? Is it the board of directors, the management, or the auditor who is ultimately responsible for internal controls designed to prevent fraud?

The expectation gap

For a long time, there has been considerable misunderstanding between auditors and nonprofit organizations as to who is responsible for what. The financial pressures of the past few years have heightened that misunderstanding.

Both associations and auditors need to take steps to close the widening gulf of misunderstanding. Nonprofit organizations must gain a better understanding of what an audit is actually designed to achieve.

For their part, auditors must take an active role in initiating dialogue with management and the board so that they can share their knowledge about best practices and other helpful information - rather than the somewhat traditional, passive role of merely preparing a report for the chief financial officer.

Audits are often designed around the organization's existing internal control structure, and a standard audit step is to determine, at the outset, to what degree the auditor may rely on those internal controls. As nonprofit organizations try to get more mileage out of the money they spend, they tend to postpone implementing time-intensive internal control procedures in favor of increased efficiency.

Given this environment, auditors are finding fewer internal controls on which they can rely, and therefore see less need to test those controls. To compensate for the lack of testing, auditors perform alternative procedures so as to issue an opinion that financial statements are "clean."

A "clean" audit opinion, however, does not mean that the organization's ethical behavior has been judged pristine. A clean opinion means only that the financial statements "fairly present" the organization's financial position - a far cry from what many nonprofit board members and executives think their auditors are telling them. Note: A financial statement audit is not a fraud audit, whose only objective is the discovery of fraud, regardless of the amount or frequency of occurrence.

Characteristics of fraud

Fraud includes not only embezzling money or abusing expense reporting - the misappropriation of assets - but also fraudulent financial reporting, sometimes called management fraud. Fraudulent financial reporting often reflects the confluence of a series of acts designed to respond to operational or budgetary difficulties.

Like their for-profit counterparts, many nonprofit executives today are judged by bottom-line results, and the pressure for them to achieve a desirable fiscal outcome is no less intense. Management fraud does not necessarily begin with an overt intentional act to distort financial statements. Initially, actions may not be fraudulent, but they become increasingly suspect across time.

Growing concern about fraud has prompted AICPA to issue a proposed new standard - likely to be approved - that would require auditors to consider various types of risk factors relating to both fraudulent financial reporting and misappropriation of assets in a financial statement audit (see sidebar, "Drawing a Bead on Fraud"). The standard would serve to heighten an auditor's awareness, should he or she uncover any fraud risk factors and raise the issue of whether additional auditing procedures needed to be conducted; discovery of risk factors would not automatically lead to a recommendation for a fraud audit.

Who is responsible and for what?

AICPA has constructed the language in the standard auditor's report to delineate clearly the responsibilities of the auditor and management. The governing body and management must recognize the limitations and assurances that the audit provides.

Governing body. Since the board is ultimately responsible for safeguarding the organization's assets, the auditor's report is addressed to the governing body charged with oversight. The governing body needs to be keenly interested in whether the financial responsibilities delegated to management have been appropriately discharged. The auditor's role here is to ensure that the organization's assets have been safeguarded and to inform the governing body of any weaknesses - known as reportable conditions - in the discharge of financial responsibilities.

The underlying reason why so many boards fail in their responsibility as guardians is the rubber-stamp syndrome - the pattern of passive support to management. Although it is up to the board to decide how it will discharge its responsibilities, direct interaction with the auditor is simply good business.

Management. The first paragraph of an auditor's report emphasizes management's responsibility for the financial statements, and by implication, its responsibility for establishing and maintaining the related internal controls. One of the common misconceptions is the belief that an audit certifies that the appropriate internal controls are working to ensure that the organization's assets are protected. It does not.

In small and even medium-sized for-profit organizations, the owners keep watch against possible fraud. In a nonprofit organization, management and the board must compensate for the absence of owners. They need to display and communicate to all employees an appropriate attitude regarding internal controls and the financial reporting process by

* communicating and supporting the organization's values or ethics;

* ensuring proper oversight by the board of directors or audit committee;

* monitoring significant controls and correction of reportable conditions on a timely basis;

* displaying respect for the law and regulatory authorities; and

* hiring an effective accounting staff.

Auditor. The first paragraph of the standard audit opinion concludes by stating that the auditor is engaged only to express an opinion on the financial statements based on the audit. If the auditor issues an unqualified opinion (i.e., clean opinion), the third paragraph of the report will state that the financial statements are fairly presented, in all material respects.

This does not mean that they are 100 percent accurate. What it does mean, in part, is that the auditor assumes responsibility for ensuring that the preferences of management do not transcend a fair presentation of financial information.

Management's dilemma

As the organization's constituency demands greater accountability, management endeavors to deliver services and products more efficiently. These two objectives are not always compatible, particularly when it comes to internal controls. As organizations "right-size" in an attempt to become more efficient, certain procedures are often eliminated, and segregation of duties diminishes.

Frequently, what remains are internal controls designed to prevent "material misstatements" in the financial reporting process. From a financial statement perspective, it is these material misstatements with which the auditor is most concerned.

Striking the appropriate balance between cost containment and improved accountability involves the classic trade-off between risk and reward. The reward of cost containment may increase the risk that improprieties will occur and not be detected by the organization or its auditors. Nonprofit organizations and their constituencies must also understand and accept the limitations of internal controls; even the best possible system can be circumvented.

Understanding the audit process

Financial statement. The audit is designed to provide reasonable assurance of detecting errors and irregularities that are material to the financial statements. The auditor's evaluation of what is material is a professional judgment made in light of surrounding circumstances and involves both qualitative and quantitative considerations.

Professional standards define materiality as "the magnitude of an omission or misstatement of accounting information that, in the light of surrounding circumstances, makes it probable that the judgment of a reasonable person relying on the information would have been changed or influenced by the omission or misstatement."

As a practical matter, most auditors measure materiality based on the size of the nonprofit organization's assets and/or revenue. For example, for an organization with $10 million in assets and annual revenue, some auditors would consider total misstatements of less than $80,000 to be immaterial. Again, however, qualitative factors are also considered. As the materiality threshold is reduced, the time associated with an audit generally increases because more testing is required. It is considerably more difficult to detect a series of smaller fraudulent transactions totaling $80,000 than it is to uncover a single $80,000 transaction.

In a publicly traded for-profit enterprise, the reasonable person relying on the financial statements is usually a sophisticated investor or lender whose primary objective is to maximize the return on money transferred to the business. Some might argue that a nonprofit organization's members and donors hold a similar objective and therefore can be considered on a par with the sophisticated investor or lender. This argument, however, ignores some fundamental differences between nonprofit and for-profit organizations.

It is easier to determine what transactions would be likely to affect the judgment of a sophisticated investor than it is to identify the transactions that would affect the thinking of a nonprofit organization's constituency, some auditors believe. Simply put, the for-profit organization's bottom-line mentality is more clear-cut because it focuses solely on maximizing profits.

For nonprofit organizations, the bottom line is not the only objective. Associations also seek to provide products, services, and benefits of value to members that enhance a trade, industry, or profession.

Qualitative assessment and management's integrity. The audit is undertaken with an attitude of professional skepticism, neither assuming that management is dishonest nor that it is above reproach. The auditor's assessment of management's integrity is important because management can direct subordinates to record transactions or conceal information in a manner that can materially misstate financial statements. When evaluating transactions that are difficult to verify, the auditor must consider his or her judgment of management's integrity.

The auditor also considers factors that constrain improper behavior by senior management - for example, the overall attitude, awareness, and actions of the board of directors with regard to the importance of controls. It is not rigid standards or bright-line tests that the auditor applies in assessing the quality of information provided by management, but rather his or her own experience, competence, and judgment.

Internal controls. The auditor's professional standards require that he or she obtain a sufficient understanding of an organization's internal controls. As mentioned earlier, management and boards frequently misunderstand that the auditor is not rendering an opinion on the operating effectiveness of an organization's internal controls.

Professional standards require only that an auditor gain an understanding of internal controls and whether they have been placed in operation, which does not necessarily mean that internal controls must always be tested. Consequently, after gaining an understanding of internal controls by observing procedures and discussing them with staff, the auditor may conclude that the cost of testing controls exceeds the efficiency that could be obtained by relying on the organization's internal controls.

The auditor must recognize that in a nonprofit organization, the control environment is influenced by the organization's size, diversity, and complexity of operations; methods of processing data; and the applicable legal and regulatory requirements. Budgetary constraints and staff size may also limit the effectiveness of internal controls.

The auditor also must recognize that internal controls are subject to inherent limitations. For example, mistakes in applying policies and procedures may arise from misunderstanding of instructions; mistakes in judgment; and personal carelessness, distraction, or fatigue.

Furthermore, control procedures that require segregation of duties can be circumvented by collusion among people both inside and outside the organization. Audit procedures that are effective for detecting a simple unintentional error may be ineffective for detecting an irregularity concealed through collusion between related parties. It goes without saying that some people will always find a way to cheat.

Related parties. One of the more important - and also one of the more difficult - aspects of the financial statement audit is the identification of related party transactions. These transactions are difficult to audit for several reasons.

First, transactions with related parties are often individually insignificant but material in total. Secondly, the auditor relies primarily upon management to identify related parties. It would be highly unlikely, for example, that an audit would detect a situation where an organization is being overcharged by a printing company in which the vice president of publications is also an owner.

Consequently, acts of misconduct involving related parties may not be detected even in a properly designed and executed audit, as was the case with William Aramony, former president of the United Way of America, who was found guilty last year of 25 counts of fraud, conspiracy, and money laundering.

Communication with the governing body

The auditor must ensure that the board is adequately informed about certain conditions encountered during the audit, including misconduct by senior management. Professional standards refer to such communication as reportable conditions. In lay-person's terms, a reportable condition means that the inadequacy or lack of controls increases the chance that the financial statements could be materially misstated.

A written communication to the board dealing with misconduct or other reportable conditions is separate from the auditor's report on the financial statements. It is important for the board to understand that the auditor can issue an unqualified (i.e., clean) opinion on the financial statements, notwithstanding the existence of immaterial misconduct or other reportable conditions.

Moreover, the auditor has no responsibility to search for or identify reportable conditions beyond those that come to his or her attention during a properly performed audit. Thus, reportable conditions could exist and not be detected during the audit, and the auditor would be under no obligation to look further.

Disclosure of misconduct to parties other than senior management and the board is not ordinarily part of the auditor's responsibility, and would generally be precluded by the auditor's ethical or legal obligation of confidentiality. (The auditor does, however, have a duty to disclose irregularities to a successor auditor or a governmental agency that provides financial assistance.)

Strengthening relationships

An AICPA advisory panel has concluded that the time has come for auditors to strengthen their relationship with boards of directors by candidly communicating their views on the quality - not only the acceptability - of an organization's financial reporting. The panel suggests that the focus will shift from a pure compliance and rule-oriented audit to one recognizing the board of directors as a client in the full sense - what might be called a "governance" approach to financial reporting. This shift will entail greater personal judgment by the auditor with a renewed emphasis on industry best practices.

With the right environment created by management and boards, auditors will have the opportunity to offer frank advice and subjective opinions about an organization's accounting choices. Candid dialogue among the board, management, and auditor - in a spirit of cooperation and not confrontation - will give boards a better understanding of the accounting practices of the organization and a better chance to avoid fraudulent financial reporting.

To reduce the risk of fraud, organizations must develop a climate that reinforces ethical behavior. Nonprofit organizations can - and should - look to their auditors for guidance in this respect.

HIGHLIGHTS

* Who is minding the store? Is it the board, the management, or the auditor who is ultimately responsible for internal controls designed to prevent fraud?

* The time has come for auditors to strengthen their relationship with boards of directors by communicating their views on the quality - not only the acceptability - of an organization's financial reporting.

RELATED ARTICLE: Drawing a Bead on Fraud

The auditing standards board of the American Institute of Certified Public Accountants, New York City, has issued a proposed auditing standard that would require auditors to consider fraud risk factors in a financial statement audit. Here are some of the key factors.

Key risk factors relating to fraudulent financial reporting

* Excessive interest in maintaining or increasing the entity's earnings trend through the use of unusually aggressive accounting practices.

* A significant portion of management's compensation represented by bonuses or other incentives, the value of which is contingent upon the entity achieving unduly aggressive targets for operating results.

* High turnover of senior management, counsel, or board members.

* Strained relationship between management and its auditor, including frequent disputes on accounting, auditing, or reporting matters; restrictions on the auditor that limit the auditor's ability to communicate effectively with the board of directors or the audit committee; and domineering management behavior in dealing with the auditor.

Key risk factors relating to misappropriation of assets

* Large amounts of cash processed.

* Anticipated future employee layoffs that are known to the workforce.

* Employees with access to assets susceptible to misappropriation who are known to be dissatisfied.

* Known and observable personal financial pressures affecting employees with access to assets susceptible to misappropriation.

* Accounting system in disarray.

* Lack of appropriate documentation for transactions.

* Lack of mandatory vacation policy for employees performing key control functions.

Charles F. Tate is a certified public accountant and managing partner of Tate and Tryon, Washington, D.C.